BIT-THRIFT-2026-94657 Apache Thrift: javame `TJsonProtocol`/`TJSONProtocol` has no string size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94656 Apache Thrift: rb `TJsonProtocol`/`TJSONProtocol` has no string size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94655 Apache Thrift: Lua `TJsonProtocol` string/number readers have no size bound and are quadratic

Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94648 Apache Thrift: dart `TJsonProtocol`/`TJSONProtocol` has no string size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94645 Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound

Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94644 Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-94634 Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-86535 Apache Thrift: A JSON member name can stall the Node server's event loop indefinitely

Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

BIT-THRIFT-2026-66055 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109192

Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

SUSE CVE-2026-86535

Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

Linux Distros Unpatched Vulnerability : CVE-2026-86535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Loop with unreachable exit condition 'infinite loop', Improperly controlled modification of object prototype attributes 'prototype pollution' vulnerability in...

CVE-2026-86535

A flaw was found in Apache Thrift. A remote attacker can exploit this vulnerability by submitting specially crafted messages to applications using the Node.js bindings with TJSONProtocol. Successful exploitation can trigger an infinite loop or cause prototype pollution unintended modification of...

Infinite loop

Overview thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. An attacker can...

Infinite loop

Overview org.webjars.npm:thrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. ...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop due to improper handling of JSON member names in the TJSONProtocol process. An attacker can cause the Node server's event loop to become unresponsive by sending specially crafted JSON input with a member name that triggers...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of a string size bound in the TJsonProtocol process. An attacker can cause excessive memory consumption by sending specially crafted large strings. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview thrift is a Ruby bindings package for Apache Thrift. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of a string size bound in the TJsonProtocol process. An attacker can cause excessive memory consumption by sending...

CVE-2026-66055 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-66055 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TJSONProtocol accepts a single JSON string/number exceeding the configured size limit (multi-language)

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...